NYC Proposes Rules to Implement New AI Audit Law

New York City has proposed rules for implementing its new law requiring bias audits of automated employment decision-making tools (AEDTs) used within the city. The proposed rules answer some of the open questions about how the law works and—to a large extent—have confirmed expectations about what covered employers must do to comply with the required bias audits and the fines that will be imposed on employers who don't.

Because audits must be completed by January 1, 2023, covered employers should start the audit process as soon as possible.

The required audits likely will take anywhere from a few weeks to a few months to complete. Covered employers should build in time for a "dry run" audit—ideally under lawyer supervision subject to privilege—so their ultimate published results will properly reflect the absence of discrimination.

The public comment period on the proposed rules closes on October 24 and culminates in a public hearing that day. The proposed rules will be subject to amendment at the hearing so are not yet final, but it is unlikely there will be significant changes to the key portions related to what an audit must involve. The proposed rules and instructions for joining the meeting (and for submitting public comment) are available here.

How to Conduct the Audit

Based on the proposed rules, key takeaways for conducting the audit itself are as follows:

• An AEDT falls under the law's ambit if it is solely responsible for making an employment decision, if its decision is weighted more heavily than other factors, or if its decision overrides a decision made by another process, including a human (for a deeper and more technical dive on the law's scope, as well as other frequently asked questions regarding the proposed rules, see here);
• Audits must provide data that allow for a disparate impact analysis based on the EEOC framework. This means determining the "selection" rate for each protected gender/race/ethnicity group and comparing it to the rate for the most-selected group; and
• An "independent" auditor is one who was not involved in "using or developing" the AEDT at issue.

Notifying Job Candidates About the Audit

On the requirement to give notice of AEDT use to job candidates or employees, the rules confirm that covered employers must give notice 10 business days before use of the AEDT as follows:

• For job candidates who reside in the city, by posting notice of the AEDT on the career or job section of the company website, in the job notice itself, or via email or U.S. mail directly to the job candidate; and
• For current employees who reside in the city, by including notice of the AEDT in a policy or procedure provided to employees, including it within a job posting, or sending it via email or U.S. mail.

The notice must provide both candidates and employees instructions on how to request an alternative selection process or accommodation. But the rules do not, on their face, explicitly require a covered employer to provide an alternative selection process. Also, a covered employer must include notice on the careers or job sections of its website or provide written notice in person, by U.S. mail or e-mail, within 30 days of receipt of a written request for such information. This notice must provide the job qualifications and characteristics the AEDT will use to assess a candidate or employee.

The employer must also disclose, if it is not already disclosed on the employer's website, information about the type of data collected for the automated employment decision tool, the source of such data, and the employer or employment agency's data retention policy.

Required Disclosures

Finally, as to the requirement to publish results of the audit, the proposed rules will require covered employers to publish the results of the most recent bias audit by including a hyperlink on the employer's website that is "clearly" identified as a link to the audit results. Further, these results must include:

• The date of the audit;
• The distribution date of the AEDT tool that is subject to the audit; and
• A summary of results, which must include the "selection rates and impact ratios for all categories."

The proposed rules also indicate that covered employers must keep a summary of the audit results and distribution date posted for at least six months after last using the AEDT for an employment decision.

Disability Accommodations

A hidden issue in this law relates to disability discrimination. The audits only address gender and race/ethnicity, but the EEOC has made clear in recent workshops that it is focused on accessibility and whether people with physical or mental disabilities are able to participate in the hiring or promotion process if a covered employer uses an AEDT. This is a more easily identifiable issue for regulators and plaintiffs because a lack of accessibility—unlike algorithmic bias—is obvious to the observer.

Act Now

Employers must remember that they cannot wait to comply with this law until January 1, 2023; as of that date, covered employers must have completed audits and published their results in order to continue using AEDTs. DWT's Employment Services Group and AI Team, in conjunction with its expert vendors, can assist with this process.

We will continue to track this developing law and associated regulations while helping clients address these issues.